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AMENDMENTS TO THE SPECIFICATION 

At page 6, lines 18-19: 

replace --For example, the code module 212 may be a Microsoft Windows executable, a 
Microsoft .NET executable, a Java applet/application, and the like.-- 

with -For example, the code module 212 may be a MICROSOFT WINDOWS 
executable, a MICROSOFT .NET executable, a JAVA applet/application, any type of executable 
or application, and the like.- 

At page 8, lines 6-9, delete -A more detailed description of dynamic behavior evaluation 
modules may be found in co-pending patent applications entitled "System and Method for 
Gathering Behaviors for a .NET Code Module" and "System and Method for Gathering 
Behaviors for a Win32 Code Module", which are incorporated herein by reference.-- 

At page 8, line 14, replace -anti-virus software 204- with -anti-virus software 204- 

At page 9, line 26, replace -dynamic behavior evaluation module 240- with -dynamic 
behavior evaluation module 204- 

At page 10, line 8, replace - FIGURE 3- with ~ FIGURE 3A~ 

At page 10, lines 22, replace -behavior signature 212- with -behavior signature 210- 
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At page 12, insert the following paragraph after line 3: 

Embodiments within the scope of the present invention also include physical and other 
computer-readable media for carrying or storing computer-executable instructions and/or data 
structures. Computer-readable media that store computer-executable instructions are physical 
storage media. Computer-readable media that carry computer-executable instructions are 
transmission media. Thus, by way of example, and not limitation, embodiments of the invention 
can comprise at least two distinctly different kinds of computer-readable media: computer 
storage media and transmission media. 
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